Cross-Site Scripting Vulnerability in NEX-Forms by Basix
CVE-2026-124270

7.1HIGH

Key Information:

Vendor

WordPress
Status
Nex-forms
Vendor
CVE Published:
15 November 2026

What is CVE-2026-124270?

The NEX-Forms plugin by Basix is susceptible to a Cross-Site Scripting (XSS) vulnerability that can lead to reflected XSS attacks. This flaw arises from improper input sanitization during web page generation. Attackers can exploit this vulnerability to inject malicious scripts into web pages viewed by other users, potentially compromising user data and session information. The issue affects all versions of NEX-Forms up to and including 9.3.3, underscoring the importance of securing web applications against such vulnerabilities.

Affected Version(s)

NEX-Forms 0 <= 9.3.3

References

https://patchstack.com/database/wordpress/plugin/nex-form...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AndrewN | Patchstack Bug Bounty Program
.